Loss due to information-based fraud, mischief, vandalism, human error, cyber-terrorism, and both natural and man-made disasters can devastate a company financially. Information attacks directed towards corporate, and personal networks are a major threat to the evolving global economy and becoming an hourly phenomena.
Ninety percent (90%) of large companies recently surveyed reported security breaches over the past 12 months. Estimated losses amounted to more than $265 million, or nearly $1 million per organization.
Last year, Denial of Service (“DoS”) attacks on each of Yahoo, CNN, eBay, Buy.com, E*Trade, and Amazon.com lasted 3-5 hours. Affected companies and peers will spend $100-$200M on infrastructure upgrades and losses related to DoS' could exceed $1 billion.
Today, corporations with e-business models face a daily barrage of information warfare tactics directed at their network infrastructures. Not only do these abuses come from malicious cyber-hackers, who strive for profit, notoriety, revenge, nuisance, but also by their own employees, vendors, suppliers, competitors, business partners, and even service providers.
Averting increasing and escalating damage during a cyber attack requires a concerted effort and cooperation from many areas within an organization and other external entities such as a Managed Service Provider (MSP), Internet Service Provider (ISP), and government or law enforcement agencies.
A secure infrastructure and security readiness will prevent most problems from occurring in the first place, and a well-planned compliance program will address the issues when cyber terrorists and hackers get past initial defenses to control, mitigate, reduce, and prevent further detrimental impact to a business.
The effectiveness of any security program is determined by what can be accomplished within a given period of time. Security is often measured by the difference between the time it takes the bad guys to get in and the good guys to lock them out.
There are numerous tools for monitoring network security and compliance purposes. These include, but are not limited to scanners such as: Security Administrators Tool for Analyzing Networks (SATAN), Security Administrator's Integrated Network Tool (Saint); as well as, Crack, nmap, nessus.
A key element in a corporation's arsenal for gaining understanding and insight as to the vulnerabilities and the risk associated with their business models, is the regular performance of security assessment. Without security assessment, a company is blind to the dangers that lie in its infrastructure. How this vulnerability information is reported is also a very important consideration due to the nature of its content.
Security assessments of computer networks have become critical for personal and commercial considerations. The proliferation of networks has led to the ubiquitous nature of connectivity we experience. With this connectivity comes the risk of exposing assets resident on the network to unwelcome intrusion and exploitation.
The increasing complexity of computer networks has made their security increasingly complex. There exist hundreds of programs intended to keep networks secure and of course hundreds of programs to crack networks.
To secure a network it is necessary to access and understand its security flaws. This is done by investigating the network's topology, by locating and probing the network's ports, fingerprinting operating systems and firewall; probing passwords as well as other techniques. Multiple tools are available for each of these and a security expert will utilize them to perform a security assessment of a network.
Among the many problems associated with conducting a security assessment are assembling, purchasing and maintaining the necessary hardware and software tools to do the job; thoroughly analyzing the data and producing an appropriate report of the results; running assessment tools without impacting the production environment's network or computers; producing data that facilitates generating different perspectives of the information; saving resources; following an accepted and rigorous process for implementing such a task; and operating in a normal office environment on an inexpensive platform. The tools required for such security audits typically include a network topology tool, a port scanner, a penetration tool, a password cracker, a report generator and a workstation.
Many tools have been provided to perform these functions individually but no tool has successfully integrated all of these functions together.
Saint™ is a tool which provides network topology and network services. It gathers its information by examining network services including NIS, and other services. Saint™ utilizes a target acquisition program that uses tcp-scan depending on whether or not the host is behind a firewall, to probe common ports testing for live hosts. Each host is then examined by a series of probes to uncover potential security flaws including incorrect setup or configured network services bugs.
NMap is a utility for security auditing that uses PCP/IP fingerprinting to determine what hosts, ports, operating systems, packet filters and firewalls are in use on a network. NMap utilizes port scanning, OS detection, ping-sweeps and many other techniques for mapping a network.
Crack is a password guessing program designed to locate weak login passwords on a UNIX based network.
YPX is a utility for transferring a network map from a host. To accomplish this, YPX can also guess the NIS domainname of the remote host.
While all of these tools are useful, none perform all of the desired tasks of a security audit. Each tool produces its own outcomes which do not integrate easily with other tools. Each tool requires its own administration. To operate each tool individually requires great resources including time and labor.